[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150814193431.GA31640@openwall.com>
Date: Fri, 14 Aug 2015 22:34:31 +0300
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: auditing our use of FMT_* flags (was: more robustness)
On Tue, Aug 11, 2015 at 12:48:55AM +0800, Kai Zhao wrote:
> After I rewrite the test_fmt_8_bit(), I find a new bug of FMT_8_BIT
> with tripcode. The old test_fmt_8_bit() only change the first character
> of the password. The new one change all the characters to OR '\x80',
> and to AND '\x7F'.
>
> static struct fmt_tests tests[] = {
> - {"Rk7VUsDT2U", "simpson"},
> + {"Rk7VUsDT2U", "si\xEDpson"},
> {"3GqYIJ3Obs", "tripcode"},
> {"Id1gMYGA52", "ponytail"},
> {NULL}
>
> The self-test result is: FAILED (cmp_all(1)). So the tripcode should
> set the FMT_8_BIT flag. Does it ?
This is tricky. Tripcodes are defined such that characters 2 and 3 of
passwords form a salt for the classic DES-based crypt(3), aka descrypt.
The latter is defined to operate on 64 valid characters only, from the
set [./0-9A-Za-z]. Tripcodes additionally define a translation table
for some characters that are not valid in salts to those that are valid:
char *from = ":;<=>?@[\\]^_`";
char *to = "ABCDEFGabcdef";
For the rest, including all 8-bit ones, behavior is undefined.
In practice, it depends on whatever implementation of crypt(3) a given
system uses. There are at least two widespread mappings of invalid salt
characters onto numeric salt values. JtR implements one of those. Your
finding suggests that this one treats 8-bit characters such that their
8th bit matters.
If FMT_8_BIT means that the 8th bit sometimes matters, even if rarely
and even if behavior may vary across systems (so JtR's attempts to crack
such passwords would not necessarily match the target system's behavior
and thus might not help), then we should set it, with a comment on why.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
